PCI DSS at Citation
Payment details are handled through Stripe’s payment interfaces and infrastructure.
Scope at a glance.
- Framework
- PCI DSS
- Status
- Stripe payments
- Applies to
- Stripe’s payment collection infrastructure and Citation’s integration with it.
Read this alongside the security controls and provider list for the features you plan to use.
Payment collection through Stripe
Citation uses Stripe for subscription and credit payment workflows. Card details are entered through Stripe’s payment interfaces, while Citation uses the resulting payment and subscription identifiers to manage access and billing.
Stripe’s PCI DSS compliance applies to its payment infrastructure. It should be distinguished from an independent PCI certification of Citation’s entire application or your organization’s own payment environment.
Confirmation and account access
A return to a payment success page is not sufficient to grant a paid entitlement. Citation processes verified payment events and uses them to update the relevant subscription or credit balance. Repeated events are handled without granting the same purchase more than once.
Billing controls let an authenticated account manage the plan through the appropriate Stripe portal. Review the displayed price, billing period and any trial terms before confirming a purchase.
Questions about a payment
Contact support with the account context and a description of the issue. Do not send full card numbers, security codes or banking credentials. The support team can identify the appropriate next step without collecting those details in a message.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Stripe’s PCI compliance information
- Payment flow and the boundary of card data collection
- Billing event verification and entitlement controls
- Support procedures that exclude full payment credentials
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Enter payment details only in the provided Stripe payment interface.
- Do not send full card numbers or security codes through support messages.
- Review subscription renewal, cancellation and account deletion as separate actions.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.